Critical Xen Orchestra authentication bypass exploited in attacks
Original title: Critical Xen Orchestra Flaws Exploited in Attacks
Builds before 6.9.2 and 6.10.1 can yield an administrator token; Vates has not assigned a CVE.
Vates says a threat actor is exploiting a critical Xen Orchestra REST authentication flaw that turns a token into an empty object and returns the first stored token, granting administrator privileges if it has not expired. Releases before 6.9.2 stable and 6.10.1 latest, plus Xen Orchestra Appliance, are affected. Compromise can yield code execution on managed pools and root takeover of XCP-ng nodes. The same actor used admin access against a second VM-import flaw whose fix is still in development.
Unconfirmed: Vates says other actors using different infrastructure cannot be ruled out, and the second flaw's fix is unfinished.
- The flaw treats an authentication token of {} as an unfiltered lookup.
- A second VM-import bug, also exploited, still has no finished fix.
- Observed activity came from 91.211.251.112:8001 and Tor.
- Unauthorized access is not logged, so missing IoCs do not prove safety.
- Vates recommends full reinstallation after a confirmed compromise.
Impact: Admin access, code execution, and root takeover of XCP-ng
| Product | Affected | Fixed in |
|---|---|---|
| Vates Xen Orchestra | before 6.9.2 (stable) and 6.10.1 (latest) | 6.9.2 (stable) and 6.10.1 (latest) |
| Vates Xen Orchestra Appliance | appliances containing affected Xen Orchestra | — |
- 1.Upgrade Xen Orchestra to 6.9.2 stable or 6.10.1 latest.
- 2.Block the empty token in a WAF and isolate instances on a dedicated network.
- 3.Rotate potentially compromised credentials and fully reinstall if compromise is confirmed.
- Vendors
- Vates
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 91.211.251.112 | veloped. Vates says a threat actor operating initially from 91.211.251.112:8001 and via the Tor network has been exploiting the vulner |
From the original article
2 min read at securityweek.com
The authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes. The post Critical Xen Orchestra Flaws Exploited in Attacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.